2022年9月5日 · A reverse-proxy Phishing-as-a-Service (PaaS) platform called EvilProxy has emerged, promising to steal authentication tokens to bypass multi-factor authentication (MFA) on Apple, Google,...

2019年1月22日 · In recent years, several researches have been published about attacks deliberately or directly related to reverse proxies. While implementing various reverse-proxy checks on the scanner, I started analyzing implementations of reverse proxies.

2020年6月22日 · HTTP request smuggling is a special web application attack that tries to exploit differences between web servers and their reverse proxies. When successful, it can allow an attacker to submit an HTTP request in the context of another user's session.

2023年6月26日 · FrontJacking is a hacking technique that combines CRLF injection, HTTP request header injection, and XSS. This technique exploits a web interface deployed in a shared hosting environment and published via a poorly configured Nginx reverse proxy.

It's a cheat sheet about behaviour of various reverse proxies and related attacks. It is a result of analysis of various reverse proxies, cache proxies, load balancers, etc. The article ( https://www.acunetix.com/blog/articles/a-fresh-look-on-reverse-proxy-related-attacks/ ) describes the goals of the research and how you can use the cheat sheet.

All sites are https only, redirect 80 to 443 and have valid Let's Encrypt certificates. A reverse proxy streamlines your approach of exposing web services. The services are then, usually, only accessible by knowing a hostname or subdomain, not directly by visiting the IP address.

2022年10月25日 · Attacks using reverse proxies are on the rise. Reverse proxy phishing attacks can now be carried out even by novice hackers thanks to the threat actors who launched EvilProxy, a fully suited Phishing-as-a-Service platform.

2024年10月16日 · Reverse proxy servers intercept client requests, which means that web servers have no direct communication with client computers. The reverse proxy server adds an extra layer of security by concealing the identity of those web servers. This increases web site protection, as hackers are only able to attack the reverse proxy server.

2024年12月12日 · From a privacy/defender point-of-view, they can be split into the following groups: VPN and TOR: These services provide the user anonymity, but the defender can, for the most part, determine that it's receiving requests from these networks.

2022年9月6日 · One of the ways that multifactor authentication can be bypassed is by using a reverse proxy. In a phishing attack, an email is sent to a target and a link is provided to a malicious website hosting a phishing form that spoofs the service of the credentials being targeted – Microsoft 365 for example.